Free tools Windows power users keep installed
One-click scans. No signup required.
If you suspect a UPI or bank account has been accessed, contact your bank immediately through its official app, website or verified phone number, report the incident to India’s cyber-fraud helpline at 1930 or the National Cyber Crime Reporting Portal, and save every transaction and complaint record. These channels do different jobs: the bank can act on your account and transaction dispute; the cybercrime channel records the crime report.
What to do first if money was debited or your account may be exposed
Move quickly, but use contact details you verify independently. Do not call a number sent by the suspected scammer, and do not let a caller or chat contact guide you to a link, app, or screen-sharing session.
As an Amazon Associate I earn from qualifying purchases.
- Contact your bank through its official channel. Report the specific unauthorized transaction, or explain that your credentials, phone or payment access may be compromised. Ask the bank to secure affected digital access or payment instruments as appropriate, prevent further unauthorized transactions, and give you a complaint reference. The Reserve Bank of India (RBI) requires banks to provide 24×7 channels for reporting unauthorized electronic transactions and to take immediate preventive steps after a customer reports one. See the RBI’s Customer Protection directions.
- Report the cyber fraud. Call 1930 or file a report through the National Cyber Crime Reporting Portal. The portal advises victims to report immediately through either route. Keep the acknowledgement or reference you receive.
- Raise the payment dispute with your bank. Report the unauthorized UPI transaction to the bank that holds the linked account. Use the UPI app’s transaction complaint option as well if available, but do not treat an app or NPCI complaint as a substitute for notifying the bank. NPCI directs unauthorized or fraudulent transaction cases to the user’s bank and says the member bank or institution is responsible for resolving complaints; see its complaint guidance.
- Secure access from a safe device. If you suspect your phone or SIM has been taken over, or you installed a suspicious app, use another trusted device to contact the bank. Ask for the bank’s official steps to secure or reset access. Do not share your UPI PIN, OTP, banking password, card details, or remote access to your device.
- Save the records before changing or removing anything. Preserve relevant texts, calls, screenshots, app notifications and transaction details. Do not delete the banking app or messages before saving evidence you may need.
What to record and preserve
Keep one incident file so you can give consistent details to the bank and cybercrime authorities. Include:
- Transaction date and time, amount, transaction ID or RRN, and the bank or wallet involved.
- The linked account details and relevant UPI ID or other payment identifiers.
- Screenshots of the transaction and related messages, notifications or suspicious interactions, if available.
- The bank complaint reference, cybercrime acknowledgement, and any police report or other case reference you receive.
The cyber-fraud reporting instructions published by the Indian Cyber Crime Coordination Centre are marked For Delhi Only; they list transaction identifiers, dates, account or wallet and UPI details, and screenshots as useful report information. Their instruction to complete an online complaint within 24 hours of a helpline-originated report should not be treated as a nationwide rule. The national portal separately advises immediate reporting through 1930 or the portal. See the Delhi-only instructions and the national portal.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to secure your UPI and banking access
Protect your UPI PIN and other credentials
NPCI says, “Please do not share your UPI-PIN with anyone.” It also says a bank’s customer support will never ask for it. Treat requests for your PIN, OTP, password or card credentials as a warning, including requests from someone claiming to be bank, app or government support. If you may have disclosed credentials, tell your bank and follow its official instructions to change or reset them. NPCI’s UPI FAQ explains PIN safety and support guidance.
Check the phone, SIM and linked app
If your SIM, phone or payment service provider (PSP) app has changed, NPCI says UPI re-registration is required. Ask your bank or app provider for its current official recovery steps; reset and re-registration flows vary. Once access is restored, review linked bank accounts and recent transactions using the app’s current official help guidance.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use the app’s controls where they fit
NPCI describes BHIM features including transaction history, complaint reporting for declined transactions, UPI PIN changes, switching linked bank accounts, and blocking or reporting users sending illicit collect requests. App labels and flows can change, and a feature for declined transactions is not necessarily the right route for an unauthorized debit. Use the current transaction complaint path and your bank’s dispute process. NPCI’s BHIM feature page describes the app’s listed capabilities.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Which channel handles which part of the incident?
| Channel | Use it for | Keep |
|---|---|---|
| Your bank, using an official contact route | Report the unauthorized debit or exposure, request immediate account-protection action, and raise the transaction dispute. | Bank complaint reference and transaction dispute details. |
| 1930 or the National Cyber Crime Reporting Portal | Report suspected financial cybercrime to the national cybercrime reporting channel. | Call or portal acknowledgement/reference and submitted details. |
| UPI app complaint option or NPCI complaint process | Submit a payment complaint where the app offers one, or use NPCI’s complaint facilitation; unauthorized/fraud cases still need to be raised with the bank. | App or NPCI complaint reference, if provided. |
What if the scammer says opening an app approved a payment?
NPCI’s January 13, 2025 clarification on the “jumped deposit” scam says that simply opening a UPI or bank app does not automatically approve a payment, and an external party cannot directly request or withdraw funds from an account. That clarification can help counter a misleading claim, but check your account for an actual debit and report any unauthorized transaction to the bank. See NPCI’s clarification.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Can you get the money back?
There is no universal guarantee that a reported scam loss will be reimbursed. Under the RBI’s July 6, 2017 directions for scheduled commercial banks (including regional rural banks), small finance banks and payments banks, customer liability depends on the circumstances and how soon the bank is notified. The direction distinguishes bank negligence or deficiency, certain third-party breaches where neither the bank nor customer is at fault, and customer negligence such as sharing payment credentials.
- For a qualifying third-party breach where neither the bank nor customer is at fault, the circular provides for zero customer liability when reported within three working days of the bank’s transaction communication. A report made after four to seven working days has capped liability; after seven working days, the bank’s board-approved policy applies.
- If customer negligence, such as sharing payment credentials, caused the loss, the customer bears the loss until notifying the bank; losses after notification are borne by the bank under the direction.
- For qualifying zero- or limited-liability cases, the circular provides for shadow reversal and requires the bank to determine liability and resolve the matter within its policy timeline, capped at 90 days. Those provisions do not mean every scam loss is immediately or fully recoverable.
These are framework rules, not a decision on an individual claim. Applicability depends on the facts and account type. Notify the bank promptly, provide the records it requests, and ask it to assess the case under the applicable RBI directions and its published process. Read the RBI direction.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
